GetShell Plugin is a tool tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed January 9, 2026; most recent activity January 9, 2026.
Chinese-speaking threat actors conducted attacks using a VMware ESXi exploit toolkit that leveraged three zero-day vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. The initial access…